Article 50 transparency rules for chatbots, generated content and deepfakes

The Article 50 transparency rules of Regulation (EU) 2024/1689 say when people must be told that they are dealing with a machine or with machine-generated content. It applies from August 2, 2026, to chatbots, to images, audio, video and text produced by generative models, to deepfakes and to emotion recognition. This guide sets out who has to do what, in plain English, using the text of the regulation in the Official Journal and the European Commission's questions and answers on Article 50 (last updated July 24, 2026), checked on October 6, 2026. It is general information, not legal advice; for the wider picture see our Regulation (EU) 2024/1689 timeline.

What does Article 50 require?

Article 50 has five duties that matter in practice. Providers are the companies that develop a system and put it on the market under their name; deployers are the people and organizations that use such a system under their own authority in a professional activity. Using these systems for purely personal, non-professional purposes is outside the regulation, according to the Commission, but a person who earns money regularly from it, or runs a business, trade or freelance activity, counts as a deployer.

Table: the duties in Article 50

When do you have to tell people they are talking to a machine?

Article 50(1) addresses the provider of the system, the company that develops it and puts it on the market under its name, not the deployer. A company that only uses a vendor's chatbot on its website is a deployer, but it is the one whose customers meet the chatbot; if it builds its own assistant on top of a model and offers it under its own name, it may be the provider. The Commission says the duty applies when four cumulative criteria are met: the system falls under the Regulation's definition; it is designed for a genuine two-way exchange with people rather than just collecting data or sending automated replies; the interaction is direct, meaning the system itself communicates with the person and not through a human intermediary; and the person is a natural person, whether a consumer, a professional or another user. Systems that work only in the background or machine to machine fall outside it. The Commission lists chatbots, agents and avatars as examples of systems that interact directly with people.

The notice is not needed when it is "obvious", and the regulation sets the test: obvious to a person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. The Commission says this exception should be read restrictively, because it takes away transparency from users. In practice, if you put a vendor's chatbot in front of your customers, check what the vendor has built in, and a clear notice at the start of the conversation is the simple way to be sure.

What has to be marked as machine-generated?

Article 50(2) applies to providers of generative systems, including general-purpose ones. The marking must be machine-readable and the solution "effective, interoperable, robust and reliable" as far as technically feasible, taking into account the type of content, the cost and the state of the art. The Commission says certain outputs fall outside it, for example a short sequence of numbers, symbols or letters, source code meant to pass machine to machine, and outputs used only in closed industrial or product-development settings unless they are the final output. The duty does not apply when the system only assists with standard editing or does not substantially alter the input or its meaning, and the Commission sets out a narrow exemption for some business-to-business and industrial uses.

A voluntary Code of Practice on transparency of machine-generated content helps providers show compliance. The Commission says it has been assessed as adequate by the Commission and by the Board set up by the Regulation, and that providers who do not sign it must show compliance by other adequate means and may face more requests for information.

What is a deepfake, and when must it be labelled?

The regulation defines a deepfake as machine-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful. The Commission says three criteria must all be met: resemblance, similarity to something that exists or could plausibly exist, and the capacity to be taken for authentic. Context counts: the intended audience and its expectations, so background scenes or special effects in a film that audiences do not take as real are unlikely to qualify.

Deployers must disclose a deepfake at the latest on first exposure, in a clear way that people can see or hear without special tools. The Commission adds that deployers cannot rely only on the machine-readable mark added by the provider. If the content is part of an evidently artistic, creative, satirical or fictional work, the duty is limited to disclosing it in a way that does not spoil the work.

When must machine-written text be labelled?

Article 50(4) covers text a deployer publishes "with the purpose of informing the public on matters of public interest". The Commission's three criteria are that the text is published, that it informs the public, and that it concerns matters of public interest, which it lists as politics and democratic processes, public administration and services, justice and law enforcement, fundamental rights, public security, public health, environmental protection, consumer safety and any economic, financial, political, scientific or cultural developments that may be relevant subject of public debate.

Such text does not need to be labelled if it has been through human review or editorial control and a natural or legal person holds editorial responsibility for its publication. The Commission defines the terms narrowly: human review is the deliberate examination of the substance of the content by people with relevant knowledge and professional judgement; editorial control is control exercised in practice by a responsible editorial entity with authority to approve, alter or reject the text on substantive grounds, including fact-checking; spell-checking or grammatical correction is not enough; and editorial responsibility means a person holds the ultimate legal responsibility for the publication.

When does it apply, and what are the penalties?

Article 50 applies from August 2, 2026. The only grace period is for generative systems already on the market before that date, which must comply with the marking duty of Article 50(2) from December 2, 2026. Content generated before August 2, 2026 does not need to be labelled retroactively, although the Commission encourages deployers to do so where possible. National market surveillance authorities mainly enforce the rules, and fines can reach 15 million euros or 3% of worldwide annual turnover, with proportionality for small and medium-sized companies and small mid-cap companies.

A checklist for a business or a website

1. List where a machine talks to people (chat widgets, voice bots, agents) and confirm the first message makes clear it is a machine, unless it is obvious. For agents, see what an agent is.
2. Ask each generative models vendor how it marks its outputs and whether it follows the Code of Practice.
3. Label deepfakes where you publish them, visibly, at first exposure.
4. Decide your policy for machine-assisted text on matters of public interest: either label it, or make sure real human review or editorial control exists and a named person or company is responsible.
5. Keep records of how you comply, and review them when the vendors or the Commission's guidance change.

These duties sit next to the others in the regulation, such as staff literacy and the bans on certain practices, covered in our Regulation (EU) 2024/1689 guide. If you deploy agents inside a company, our guide to agents for business covers risks and costs.